CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2019-10788
Critical (9.8) in dnt im-metadata. EPSS 2.4% chance of exploitation in the next 30 days.
im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the "exec" function.
Severity
- EPSS
- 2.4% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dnt:im-metadata
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qfxv-qqvg-24pg | npm | im-metadata | <=3.0.1 | no fix published |